JFIF$        dd7 

Viewing File: /usr/local/cpanel/scripts/securemysql

#!/usr/local/cpanel/3rdparty/bin/perl

#                                      Copyright 2024 WebPros International, LLC
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited.

use strict;
use warnings;

use Getopt::Std;
use Cpanel::MysqlUtils::Check        ();
use Cpanel::MysqlUtils::Secure       ();
use Cpanel::SafeRun::Simple          ();
use Cpanel::MysqlUtils::Connect      ();
use Cpanel::MysqlUtils::MyCnf::Basic ();
use Cpanel::AdminBin::Serializer     ();    # PPI USE OK - loadConfig speed
use Cpanel::Config::LoadConfig       ();    # PPI USE OK - For MyCnf::Basic
use Cpanel::PwCache                  ();    # PPI USE OK - For MyCnf::Basic
use Try::Tiny;

# Only run if executed by root
exit if ( $> != 0 );

# Don't run if MySQL is not used
exit if ( -e '/etc/securemysqldisable' || -e '/etc/mysqldisable' );

my $version = qq{0.3};
my $verbose = 1;
my $fast    = 0;
my $help    = 0;
my $actions = q{};

my %options;
getopts( 'qFha:', \%options );
if ( exists $options{'q'} ) {
    $verbose = 0;
}
if ( exists $options{'F'} ) {
    $fast = 1;
}
if ( exists $options{'h'} ) {
    $help = 1;
}
if ( exists $options{'a'} ) {
    $actions = $options{'a'};
    if ( !defined $actions || $actions eq '' ) { $actions = 'all'; }
}
my @actions;
if ( $actions ne 'all' && $actions ne '' ) {
    $actions =~ s{ [^a-z0-9,]+ }{}gxms;
    @actions = split /,/, $actions;
}
my $actionsall = 0;
if ( $actions eq 'all' || grep m{ \A all \z }xms, @actions ) { $actionsall = 1; }
if ($actionsall)                                             { print "Performing all actions.\n" if $verbose; }
my %actions = (
    'removeanon'         => $actionsall,
    'removetestdb'       => $actionsall,
    'removelockntmp'     => $actionsall,
    'removeremoteroot'   => $actionsall,
    'chowndatadir'       => $actionsall,
    'removepublicgrants' => $actionsall,
);
foreach my $action (@actions) {
    if    ( exists $actions{$action} || $actionsall ) { $actions{$action} = 1; }
    elsif ($verbose)                                  { print "Invalid action $action ignored.\n"; }
}

$actions{'securemycnf'} = 1;    # we always do this

if ( !-t STDOUT ) { $verbose = 0; }

if ( $help || ( $verbose && !$fast ) ) {
    print <<"EOM";
securemysql $version

 Options:
 -q  - Quiet execution
 -F  - Bypass the help message
 -a  - Specify additional actions (comma separated list), or blank for all
 -h  - Print this message and exit.

This script attempts to secure the MySQL configuration by doing the following:
 (always executed) Ensure root password for MySQL is set.
 (always executed) Changes ownership of /var/db/mysql or /var/lib/mysql to mysql
 Additionally, the following actions can be specified:
    [optional]
    removeanon           - Remove any anonymous users
    removetestdb         - Remove test database
    removelockntmp       - Remove global lock tables and create tmp table privileges from users
    removeremoteroot     - Remove remote root login
    chowndatadir         - Chown the mysql data directory to mysql:mysql
    removepublicgrants   - Removes insecure public grants on MariaDB 10.11 and later.

 Examples:
    ./securemysql -q -F -a removeanon,removetestdb,removelockntmp,removeremoteroot
    ./securemysql -q -F -a "removeanon, removetestdb, removelockntmp"

EOM
    exit if $help;
    sleep 5;
}

if ( Cpanel::MysqlUtils::MyCnf::Basic::is_remote_mysql() ) {
    print "Remote MySQL configured. Exiting.\n" if $verbose;
    exit;
}

my $err;
my $dbh;
try {
    $dbh = Cpanel::MysqlUtils::Connect::get_dbi_handle();
}
catch {
    $err = $_;
};

if ( !$dbh ) {

    my $ret      = Cpanel::SafeRun::Simple::saferun( '/usr/local/cpanel/scripts/restartsrv_mysql', '--check' ) // '';
    my $check_ok = $? == 0 ? 1 : 0;

    if ( !$check_ok ) {

        # This will force a password reset if password is wrong/blank
        $check_ok = Cpanel::MysqlUtils::Check::check_mysql_password_works_or_reset();

        if ( !$check_ok ) {

            # Case 169937, if I die here it will show like an error on the main
            # screen.
            print "Mysql is not running: $ret: $err\n";
            exit;
        }
    }
    $dbh = Cpanel::MysqlUtils::Connect::get_dbi_handle();
}

if ( values %actions ) {
    Cpanel::MysqlUtils::Secure::perform_secure_actions( $dbh, \%actions, $verbose );
}
Back to Directory  nL+D550H?Mx ,D"v]qv;6*Zqn)ZP0!1 A "#a$2Qr D8 a Ri[f\mIykIw0cuFcRı?lO7к_f˓[C$殷WF<_W ԣsKcëIzyQy/_LKℂ;C",pFA:/]=H  ~,ls/9ć:[=/#f;)x{ٛEQ )~ =𘙲r*2~ a _V=' kumFD}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo(3=M(zȰ+i*NAr6KnSl)!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\͔]ޒS߼Jȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtfh9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N+0e2]]9VTPO׮7h(F*癈'=QVZDF,d߬~TX G[`le69CR(!S2!P <0x<!1AQ "Raq02Br#SCTb ?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ τV׸YTD I62'8Y27'\TP.6d&˦@Vqi|8-OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL u"TÙM=6(^"7r}=6YݾlCuhquympǦ GjhsǜNlɻ}o7#S6aw4!OSrD57%|?x>L |/nD6?/8w#[)L7+6〼T ATg!%5MmZ/c-{1_Je"|^$'O&ޱմTrb$w)R$& N1EtdU3Uȉ1pM"N*(DNyd96.(jQ)X 5cQɎMyW?Q*!R>6=7)Xj5`J]e8%t!+'!1Q5 !1 AQaqё#2"0BRb?Gt^## .llQT $v,,m㵜5ubV =sY+@d{N! dnO<.-B;_wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc.WDtA$j@:) -# u c1<@ۗ9F)KJ-hpP]_x[qBlbpʖw q"LFGdƶ*s+ډ_Zc"?%t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi`]uJVoVDG< SB6ϏQ@ TiUlyOU0kfV~~}SZ@*WUUi##; s/[=!7}"WN]'(L! ~y5g9T̅JkbM' +s:S +B)v@Mj e Cf jE 0Y\QnzG1д~Wo{T9?`Rmyhsy3!HAD]mc1~2LSu7xT;j$`}4->L#vzŏILS ֭T{rjGKC;bpU=-`BsK.SFw4Mq]ZdHS0)tLg